It is not an adequate ethical standard to aspire to get through the day without being indicted. (Richard Breeden, SEC Chairman 1989–93)

Organisational culture is a topic that has rarely been out of the spotlight in recent years. A succession of high profile examples of poor behaviour and/ or competence spanning the private, public and voluntary sectors — not to mention countries — has brought into sharper focus the importance of culture to an organisation’s failure or success, and sparked a growth industry in culture ‘measurement’ as boards and executive teams grapple with this issue.

This paper describes a new approach being undertaken within the UK banking sector to help firms, individually and collectively, manage culture. It provides the boards of banks and building societies with objective evidence, support and challenge on issues relating to culture, behaviour and competence, and facilitates cross-firm working to identify good practice and lessons learned. Led by the Banking Standards Board (BSB), this work is still in its early stages, and comments or questions would be very welcome in helping us continue to develop it in the most useful and effective way.

Before setting out the BSB’s approach, however, we consider first what we mean when we talk about the ‘culture’ (or indeed, ‘cultures’) of an organisation. Why does culture matter, in particular from a risk management perspective? And if it does matter, how do we know if it is a ‘good’ culture and what can be done to manage, change or maintain it?

What do we mean by ‘culture’ in the context of an organisation?

There are numerous descriptions and definitions of culture, with one of the most frequently cited being that it is ‘the way things get done when no one is looking’. While this nicely conveys the sense of deep-rootedness and innateness that we instinctively associate with culture, it does not quite capture its entirety. More accurate, albeit considerably less catchy, would perhaps be to say that we can learn a great deal about a group’s culture from observing what gets done when no one in authority is looking; although it would also be correct to say that we can also learn about the culture from what gets done when lots of people in the group happen to be looking.

More formally, culture can be said to refer to the collective assumptions, values, beliefs and expectations that shape how people behave in a group. It runs deeper than the dress-code, the floor layout or the set of values displayed in the lobby, although these visible characteristics1may reflect and potentially reinforce the underlying culture.

While a person on their own can have values and ethics, culture is a group concept. A group’s shared norms help determine status within it; they influence what is praiseworthy and held in esteem, and what is considered shameful or embarrassing. Given its importance to the way that individual members of a group perceive themselves, a change in the culture can be highly destabilising and met with considerable resistance. Furthermore, as culture is a function of the group rather than the individual, someone switching over the course of a day between different groups (e.g. work, home, friends, sport, online) may themselves behave differently as they shift from one group and one cultural norm to another.

A firm cannot choose whether or not to have a culture. What its leaders, managers and influencers have the opportunity to decide, however, is what sort of culture they wish to see, and whether and how to manage it.2 ‘Culture’, in the words of Andrew Lo, ‘can be a choice, not a fixed constraint’ (p. 38).2Why does an organisation’s culture merit an investment of time and effort, and why should it matter to risk professionals in particular?

Why does a firm’s culture matter?

Understanding a firm’s culture matters because it is fundamental to the way in which a strategy agreed in the boardroom actually takes effect. ‘Culture trumps strategy’ will be a familiar maxim to many and one that some may dispute; but, if organisational culture is about the values, beliefs and norms of a group, it will certainly inf luence the way in which any given strategy is implemented by that group (and indeed whether it is implemented at all).1

For firms in regulated sectors, compliance (or, as it tends to be measured in practice, the incidence of non-compliance) may say much about the firm’s culture. The two should not, however, be confused. Culture will shape attitudes to compliance, certainly; it also, however, goes well beyond it, determining how people behave in situations where regulation is not applicable, is unclear or has simply not kept up with reality.

Regulation is not and cannot be the answer to every question. It will always be incomplete; however, prescriptive and wide-ranging rules cannot determine ex ante every judgment an employee has to make, or keep up with social and technological change or with human inventiveness. Is anything not prohibited or mandated by regulation, fair game? Is finding a legal way to circumvent the rules seen as admirable? While these might certainly be characteristics of one sort of organisational culture, it would probably not be one that many board members, regulators, customers or employees would regard as desirable. Regulation cannot achieve its aims without accompanying ethical and — using the term in its broadest sense — professional standards on the part of those being regulated. Such standards, helping align actions and motives, are rooted not in law, but in institutional practice and norms — in culture.3

Viewed from the perspective of effective risk management, understanding a firm’s culture (or cultures, given it may have several) is clearly important. If risk is to be managed appropriately at all levels and in all parts of the firm, what does this imply for each employee’s sense of responsibility, behaviour and competence? How to be confident that the spirit of regulations and internal rules is being respected, rather than the letter carefully complied with or even gamed? And if someone does see something that might be of concern or simply identifies a way of doing something better, are they likely to f lag this or to ignore, sit on or conceal it? Effective risk management requires an effective risk culture across the entire firm, and an effective risk culture cannot be separated from the culture of the firm as a whole (or, of course, that of the risk team itself).

If understanding a firm’s culture is important to its success, developing that understanding may be neither simple nor straightforward. Culture, unlike balance sheets or conduct fines, does not lend itself readily to measurement. This does not, however, mean that culture is an evidence-free zone. Engagement surveys, pulse surveys, focus groups, ‘town halls’ and internal social media are among the approaches used by many leadership teams to engage with employees and to build a picture of the firm’s culture. Information from these sources may then be analysed alongside compliance and conduct data, customer or other stakeholder complaints or feedback, and internal management information relating to performance reviews, sickness absences, etc. Culture is clearly a difficult concept to measure. Is it, however, sensible to think in terms of measuring it at all?

Can culture be measured?

There is no single ideal ‘culture’ to which every organisation should or can aspire. Even within the same business sector, each firm will have its own culture ref lecting its past, its people, its size, the environment it operates in (eg, physical, regulatory) and its purpose. A firm’s culture will be individual to it; a part of its identity and a source of competitive advantage or disadvantage. It may also, of course, change over time, by design or as the factors that shape the culture themselves change. If there is no one template for what a firm’s culture should look like, it is difficult to speak about being able to measure it. The comparator, let alone the unit of measurement, is unclear. Furthermore, attempting to encapsulate a concept as complex as culture in a single number risks at best presenting an only partial picture, and at worst distorting behaviour as actions are taken to improve what is a misleading and overly simplistic metric.

If culture does not lend itself to measurement, this does not however mean that it cannot be judged — something that we already do naturally in our routine use of terms such as ‘good’ or ‘bad’ to describe an organisation’s culture. There may be many different cultures that we would consider ‘good’ and a myriad of ‘bad’ ones; and a firm may also, of course, move over time across this spectrum in either direction. The real question, then, may be not how to measure culture, but how to judge and assess it as rigorously, consistently and usefully as possible. This is the challenge currently being addressed within the UK banking sector by the BSB.

The Banking Standards Board

In 2011, following the banking crisis and in the wake of the Libor-rigging scandal, the Parliamentary Commission on Banking Standards was established in the UK to examine the underlying causes of this and other widespread failings in the UK banking sector. Having taken evidence from a wide range of sources, the Commission concluded that: The weakness in standards and culture that has contributed to the loss of public trust in banks has not been confined to isolated parts of a few sub- standard banks. It has been more pervasive.Trust in banking can only be restored when it has been earned, and it will only have been earned when the deficiencies in banking standards and culture, and the underlying causes of those deficiencies, have been addressed. (Parliamentary Commission on Banking Standards, 2013)4

Following the Commission’s report, a number of firms in the UK banking sector took the initiative to establish in April 2015 a new body, the BSB.5The BSB is a non-statutory membership organisation open to all banks and building societies operating in the UK. It is governed by an independent board with a majority of non-practitioner members,6and its purpose is to help raise standards of behaviour and competence across the sector. In order to do this, it has developed an approach to assessing organisational culture within and across its member firms. The cross-firm evidence from this assessment exercise then facilitates the identification and development of good practice, itself informed by shared learning from both within and outside the sector.

An outcomes-based approach

The BSB’s assessment framework sets out to measure not the culture per se of a firm, but the outcomes generated by that culture within the firm. Its premise is that there are outcomes that we would expect to be associated with any form of ‘good’ culture, and that would be less apparent or absent in a firm with a ‘bad’ culture of whatever type. While every individual firm’s culture will be different (and changing over time), the outcomes of that culture can be measured and compared in a consistent manner over time and across firms.

The choice of outcomes is clearly central to the interpretation, use and practical value of this approach. Are we, for example, expecting to see increased profitability, better revenues or (where applicable) a higher share price from a good culture? We might justifiably expect a firm with a good culture to be better placed in terms of its sustainable financial position than one without. Taking profits, revenues or share prices as the primary outcome — and especially when looking at the correlation with culture over a short time period — could, however, quickly produce conclusions as to what a ‘good’ culture should look like, that many observers might question.

An alternative could be to look to conduct as the outcome, and judge a ‘good’ culture by reference to this. Certainly, good conduct would, one would hope, be one outcome of a good culture. It is not, however, the only outcome; and good conduct itself tends to be equated in practical terms with the absence of misconduct, rendering it even more partial. Taking an absence of conduct breaches as the primary signifier of a ‘good’ culture, would risk prizing an environment in which employees were reluctant to take on responsibility, own risk or suggest innovative ways of doing things; again, not what many people would regard as a common-sense description of a ‘good’ organisational culture.

The BSB’s core purpose is, as mentioned, to help raise standards of behaviour and competence across the UK banking sector. We are interested in this, not primarily because higher standards should enhance the sector’s financial performance, but rather because they should improve the service provided to customers, whether consumers, members or clients. The outcome measures appropriate to an assessment of culture should, in this context, relate therefore to outcomes for customers. Alongside this, and given the vital role of banks and building societies in the UK economy and the many hundreds of thousands of people who work in the sector, outcomes for employees and for society as a whole should also form part of this picture.

The BSB Assessment Framework

Assessing culture by reference to customer, employee and wider societal outcomes is considerably more difficult than using relatively concrete and available yardsticks such as revenue or data on conduct fines. Making direct links between cultural change and customer outcomes is very much a work in progress. Given this, what can we do in the meantime to translate customer outcomes into something that is tangible and reliably measurable, and that can be linked to culture, behaviour and competence — and in a sector as large and organisationally diverse as banking?

Taking its choice of outcomes as the starting point, the BSB assessment framework considers the qualities that banks or building societies need to exhibit to ensure that they are best placed to serve their customers, clients, members (for building societies), employees and broader society. Having reviewed the numerous studies on bank culture, taken input from academics across multiple disciplines and conducted our own field research — and drawing also on the work of Onora O’Neill on trustworthiness7— we identified nine characteristics that we considered should be indicative of an organisation’s willingness and ability to serve its customers and society well and were therefore associated with and described a ‘good’ culture. These nine characteristics, which encompass a range of ethical and professional aspects of behaviour and competence, are shown in Figure 1.

The nine characteristics are designed to be applicable to any firm in the banking sector irrespective of its size, business model, market segment, age, ownership structure, location or customer base. Furthermore, and while the framework has clearly been designed with the UK banking sector in mind, it is neither banking nor UK specific in its relevance. These are basic characteristics that would arguably be regarded as desirable by customers, employees or stakeholders of organisations in any sector or jurisdiction.

The BSB assessment exercise then asks how far each of the nine characteristics of the framework is demonstrated within a firm. It does this by gathering evidence from a number of sources, all currently within the firm, although this may change as the approach develops.

The first data source, and the one that allows us to compare results across firms, is the BSB Employee Survey. The survey consists of 37 questions.8All but one of these relate to one of the nine characteristics; the final question asks respondents to describe their firm in three words. The survey is run in each firm on a consistent, stand-alone basis in order to avoid firm-specific framing effects that might introduce bias to answers. It is sent to a sufficient number of employees in each firm to provide statistically representative results for different business areas within the firm. In 2016, the first year in which the survey was run, more than 28,000 employees from 22 firms responded; in 2017, more than 36,000 took part from across 25 firms.

Respondents are asked to agree or disagree with the statement in each question on a five-point scale. The results are then used to calculate scores out of 100 for each question and for each of the nine characteristics of the assessment framework. The quantitative output of the survey is complemented for many firms (recognising that smaller firms in particular may prefer not to participate in the full exercise every year) by qualitative information derived again from all levels of the firm. This qualitative material is obtained through firm-specific focus groups with employees, as well as written submissions from boards and interviews with non-executive directors and executives. Over the course of the two assessments of 2016 and 2017 we held focus groups with a total of more than 1,550 junior and middle-ranking employees, working with firms to try to ensure that participants were drawn from as many areas of the firm as possible, and that no one’s line manager was part of the same conversation.

Each firm receives its own survey results (and, for those taking part in the qualitative exercise, the findings from the fuller exercise). The survey results are provided through an online dashboard that allows the firm to cut and analyse the data in multiple ways, subject always to constraints imposed to protect respondents’ anonymity. The results allow each firm’s score for each characteristic and question to be compared with those of all other participating firms. These comparisons are available not just at the level of the firm, but also for individual business areas within it (allowing a firm to compare, for example, scores and responses from employees on a trading floor with those from employees on trading floors elsewhere, or retail branch scores and responses with those from retail branches in other firms).

While each firm can see the positioning and distribution of other participating firms, the other firms are not identified, and comparative results are not provided if there are fewer than seven firms in the comparator group. The data can also be analysed by the firm in terms of gender and a small number of other characteristics, subject again to the constraints imposed to protect anonymity.

The annual survey results, complemented by an analysis of the qualitative evidence where this additional part of the exercise was undertaken, give boards and senior teams an independent, external and evidence-based perspective on their firm’s culture. They allow firms to gauge both where they are performing well and where progress needs to be made, and to see this across different parts of their organisation, against their peers and over time.

Having designed the assessment approach in 2016, the BSB’s focus in 2017 was on making the results as accessible and useful as possible for both member firms and the BSB itself. This included building both a new survey platform (which also enables firms to track response rates in real time across their organisation), and the online dashboard noted above that allows firms more easily to analyse current and historical survey data. Construction of the platform and dashboard also means that the survey is technically scalable, including potentially across firm that are global groups (and, in principle, even outside the banking sector).

Looking ahead, we are continuing to develop the assessment model and will consider whether and how other sources of information can and should also usefully be incorporated in the assessment or inform analysis of the results. These additional types of information could come from firms themselves, from customers (our first consumer consultation was launched in November 20179), or from third parties. Development of the inputs to the assessment is something we will continue to explore, as well as new techniques and approaches to analysing the data and testing the validity of our conclusions.

The 2016 Assessment results

BSB reports on individual member firms go only to the board of the firm concerned; the BSB itself does not publish these reports or any other firm-specific data. We do, however, publish in spring each year an Annual Review containing aggregate data from the assessment and setting out themes and issues arising from the analysis.

The range and distribution of scores for each of the nine characteristics across all of the firms that took part in the 2016 survey are shown in Figure 2. More survey results are available in the 2017 Annual Review8and on the BSB’s website. Results from the 2017 assessment exercise will be published in the next Annual Review, in spring 2018.

Three themes emerged from the 2016 Assessment:

an apparent mismatch in many firms between the organisation’s stated values and the way that some employees saw business being done;

the challenge of developing a culture of responsibility and accountability rather thanof blame — how to create an environment in which mistakes are learned from, ideas encouraged, professionalism prized and a diversity of views valued and fostered; and

personal resilience and well-being — ensuring that employees of UK banks and building societies are able to serve their customers, members and clients well.

These themes helped shape the BSB’s work in 2017,8and the 2017 assessment exercise itself allowed us to dig into some of the issues in more detail. We included, in this second annual assessment, a small number of additional survey questions that were not used for benchmarking comparisons, but were intended to help firms respond as effectively as possible to particular issues. A respondent who, for example, considered that their firm’s values were at odds with the way in which the firm did business, could in 2017 identify via one of the additional questions, which of the firm’s values this applied to (selecting from a firm-specific list). Information from additional survey questions will, we hope, be particularly useful for those (primarily smaller) firms that may not take part in the qualitative aspect of the assessment in a given year, and where we cannot therefore discuss emerging issues with focus group participants.

One of the themes we explored further in the 2017 survey was that of responsibility and accountability and, within this, speaking up and challenge. A healthy organisational culture needs employees to feel able and willing to speak out if they see something that is at odds with the firm’s aims or values, or that can be improved. Speaking up is, however, very difficult. Human beings are primed to conform — this is, after all, what supports a group culture — and speaking up, by definition, entails going against the tide. Given this, leaders of organisations need not just to allow feedback and challenge, but actively to encourage and invite it. They also, importantly, need to show credibly that it is something worth doing and to understand the reasons why it may not be happening.

People may be reluctant to speak up, because they doubt the confidentiality of the firm’s processes or are unsure about their manager’s reaction, so would be concerned about the consequences. Equally, they may be entirely comfortable with the process but feel that speaking out would set them apart from colleagues who in the context of a very supportive working environment, have become friends; or they may simply decide not to say anything because they have learned from experience, or from what their colleagues have told them, that nothing happens even when someone does speak up. Having in place a confidential, trusted and well-publicised whistle-blowing procedure is an important and necessary step in ensuring that people feel able to speak up safely. It will not, however, on its own be sufficient to address a reluctance to speak out that stems from friendship, organisational inertia, or a story from several years previously about what happened when someone did speak up and that remains the dominant narrative.

Encouraging people to speak out and challenge — something that is central to a good risk culture — requires effort on the part of those leading an organisation to address all of the many factors that will reinforce conformity; to make, in other words, challenge and continuous improvement so acceptable that they become the norm. This requires not just talking about what’s expected, but acting it out: demonstrating constructive challenge, for example; inviting and visibly responding to feedback; or sharing personal examples about speaking out, being challenged or making and learning from mistakes.

To have credibility and carry weight, especially on an issue as difficult as speaking up, leaders need not just to tell stories about what is expected; they need to be in the stories that other people are telling. One interesting aspect of the assessment focus group discussions, in this context, is the extent to which participants talking about values or behaviours refer to the example set by their leaders or managers, or whether the latter are notable by their absence.

A work in progress

If risk management is about processes, policies and people, the effectiveness of the first two will always be contingent on the third. Understanding and managing an organisation’s culture is central to understanding and managing its risk, and especially in a context of technological, social, demographic and numerous other sources of change. The UK banking sector is taking forward a new approach to assessing and managing culture with the aim of raising standards of behaviour and competence across the sector. This approach has potentially wider application and may also be of particular interest to risk management professionals; all comments, questions and views would be very welcome to help us continue to develop and improve it.10

References and notes

What Schein would call the ‘artefacts’ of an organisational culture, as opposed to the espoused values or the basic assumptions and values, see: Schein, E.H. (2010) Organisational culture and leadership, Jossey-Bass, San Francisco, CA.